@seams/wallet-server 0.6.2 → 0.7.3

package/dist/esm/router/transport/fetch/routes/sessions.js

@@ -1,20 +1,20 @@
 import { parseOrgId, parseProviderSubject, parseWalletAuthMethodId, parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseMpcWalletSigningQuotaId, parseWalletSessionId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { sha256HexUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { base58Encode } from "../../../../shared-ts/src/utils/base58.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { normalizeRuntimePolicyScope } from "../../../../shared-ts/src/threshold/signingRootScope.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1, parseRouterAbEcdsaPostRegistrationSessionActivationResponseV1, sameRouterAbEcdsaDerivationPublicCapabilityV1, sameRouterAbEcdsaRegistrationActivationReceiptV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { parseHostedWalletSeamsSessionExchangeCode, parseHostedWalletSeamsSessionExchangeNonce, parsePrimaryWalletSessionOperationCredentialToken, parseSessionOrigin, projectExactWalletSessionAuthorizationV1 } from "../../../../authorization/domain.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { json, readJson } from "../../../framework/http.js";
 import { extractBearerCredential, resolveSourceIpFromFetchHeaders } from "../../../auth/routerApiKeyAuth.js";
 import { routerApiEmailOtpRouteService } from "../../../framework/authServicePort.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emailOtpStatusCode, hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { emitRouterApiWebhookEvent } from "../../../framework/routerApiWebhooks.js";
 import { parseWalletEmailOtpLoginOperation } from "../../../domains/emailOtp/emailOtpRequestValidation.js";
 import { handleWalletUnlockChallengeRoute, handleWalletUnlockVerifyRoute } from "../../../domains/walletUnlock/walletUnlockRouteHandlers.js";
@@ -123,6 +123,7 @@ async function resolveWalletEmailOtpChallengeSignerSelection(args) {
 		};
 	}
 	const resolved = await args.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+		source: { kind: "database" },
 		walletId: String(args.authority.walletId),
 		materialActivation: routerAbMpcMaterialActivationRefToWire(ecdsaActivation.materialActivation)
 	});

package/dist/esm/router/transport/fetch/routes/syncAccount.js

@@ -1,14 +1,12 @@
 import { parseWalletId, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parseAuthFactorId, parsePrincipalId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
-import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
-import "../../../../shared-ts/src/utils/encoders.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
+import { alphabetizeStringify } from "../../../../shared-ts/src/utils/digests.js";
+import { sha256Utf8DigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { parseSessionOrigin, parseVerifiedOwnerProofId } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletSessionPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
-import { json, readJson } from "../../../framework/http.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
+import { json, jsonFailure, readJson } from "../../../framework/http.js";
 import { parseSyncAccountOptionsRequest, parseSyncAccountVerifyRequest } from "../../../domains/syncAccount/syncAccountRequestValidation.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";
 import { issueSyncAccountBootstrapV1 } from "./syncAccountBootstrap.js";
@@ -57,11 +55,7 @@ async function handleSyncAccount(ctx) {
 		let responseBody = result;
 		if (result.ok && result.verified && result.thresholdEd25519) {
 			const custodyKeyManifestDigestB64u = result.custodyKeyManifestDigestB64u;
-			if (!custodyKeyManifestDigestB64u) return json({
-				ok: false,
-				code: "internal",
-				message: "Sync verification did not resolve the wallet key manifest"
-			}, { status: 500 });
+			if (!custodyKeyManifestDigestB64u) return jsonFailure(500, "internal", "Sync verification did not resolve the wallet key manifest");
 			const thresholdEd25519 = result.thresholdEd25519;
 			const walletId = String(result.walletId || "").trim();
 			const nearAccountId = String(result.nearAccountId || "").trim();
@@ -69,11 +63,7 @@ async function handleSyncAccount(ctx) {
 			const signerSlot = Number(result.signerSlot);
 			const walletBinding = result.walletBinding;
 			const credentialIdB64u = String(result.credentialIdB64u || "").trim();
-			if (!thresholdEd25519 || !walletId || !nearAccountId || !nearEd25519SigningKeyId || !Number.isSafeInteger(signerSlot) || signerSlot < 1 || !walletBinding || !credentialIdB64u || !String(result.publicKey || "").trim() || !String(result.credentialPublicKeyB64u || "").trim() || String(walletBinding.walletId) !== walletId || String(walletBinding.nearAccountId) !== nearAccountId || String(walletBinding.nearEd25519SigningKeyId) !== nearEd25519SigningKeyId || walletBinding.signerSlot !== signerSlot) return json({
-				ok: false,
-				code: "internal",
-				message: "verified passkey wallet is missing its Ed25519 Yao identity"
-			}, { status: 500 });
+			if (!thresholdEd25519 || !walletId || !nearAccountId || !nearEd25519SigningKeyId || !Number.isSafeInteger(signerSlot) || signerSlot < 1 || !walletBinding || !credentialIdB64u || !String(result.publicKey || "").trim() || !String(result.credentialPublicKeyB64u || "").trim() || String(walletBinding.walletId) !== walletId || String(walletBinding.nearAccountId) !== nearAccountId || String(walletBinding.nearEd25519SigningKeyId) !== nearEd25519SigningKeyId || walletBinding.signerSlot !== signerSlot) return jsonFailure(500, "internal", "verified passkey wallet is missing its Ed25519 Yao identity");
 			const authority = passkeyWalletAuthAuthorityForMethod({
 				walletId: walletBinding.walletId,
 				rpId: walletBinding.rpId,
@@ -85,29 +75,17 @@ async function handleSyncAccount(ctx) {
 				rpId: authority.verifier.rpId,
 				credentialIdB64u: authority.factor.credentialIdB64u
 			});
-			if (!activeAuthority.ok || activeAuthority.walletAuthority.authorityId !== result.walletAuthorityId || activeAuthority.authMethod.walletAuthMethodId !== result.walletAuthMethodId) return json({
-				ok: false,
-				code: "internal",
-				message: "Verified passkey wallet authority is unavailable"
-			}, { status: 500 });
+			if (!activeAuthority.ok || activeAuthority.walletAuthority.authorityId !== result.walletAuthorityId || activeAuthority.authMethod.walletAuthMethodId !== result.walletAuthMethodId) return jsonFailure(500, "internal", "Verified passkey wallet authority is unavailable");
 			const authorityRef = await walletAuthAuthorityRef({ authority });
 			const principalId = parsePrincipalId(walletId);
 			const mintId = parseWalletSessionMintId(parsed.request.challengeId);
-			if (!principalId.ok || !mintId.ok) return json({
-				ok: false,
-				code: "internal",
-				message: "Verified passkey Wallet Session identity is invalid"
-			}, { status: 500 });
+			if (!principalId.ok || !mintId.ok) return jsonFailure(500, "internal", "Verified passkey Wallet Session identity is invalid");
 			const issuedAtMs = Date.now();
 			const expiresAtMs = issuedAtMs + DEFAULT_WALLET_SESSION_TTL_MS;
 			const origin = parseSessionOrigin(parsed.request.expected_origin);
 			const factorId = parseAuthFactorId(`passkey:${credentialIdB64u}`);
 			const credentialId = parseWebAuthnCredentialIdB64u(credentialIdB64u);
-			if (!factorId.ok || !credentialId.ok) return json({
-				ok: false,
-				code: "internal",
-				message: "Verified passkey factor identity is invalid"
-			}, { status: 500 });
+			if (!factorId.ok || !credentialId.ok) return jsonFailure(500, "internal", "Verified passkey factor identity is invalid");
 			const proof = await ctx.service.authorizedOperations.buildVerifiedOwnerProof({
 				purpose: "wallet_session",
 				proofId: parseVerifiedOwnerProofId(`sync-account:${parsed.request.challengeId}`),
@@ -120,16 +98,12 @@ async function handleSyncAccount(ctx) {
 					audience: origin,
 					factorId: factorId.value,
 					credentialIdB64u: credentialId.value,
-					assertionDigest: parseDigestB64u(base64UrlEncode(await sha256BytesUtf8(alphabetizeStringify(parsed.request)))),
+					assertionDigest: await sha256Utf8DigestB64u(alphabetizeStringify(parsed.request)),
 					verifiedAtMs: issuedAtMs,
 					expiresAtMs
 				})
 			});
-			if (proof.purpose !== "wallet_session") return json({
-				ok: false,
-				code: "internal",
-				message: "Owner proof purpose is invalid"
-			}, { status: 500 });
+			if (proof.purpose !== "wallet_session") return jsonFailure(500, "internal", "Owner proof purpose is invalid");
 			const bootstrap = await issueSyncAccountBootstrapV1({
 				ctx,
 				result: {
@@ -170,11 +144,7 @@ async function handleSyncAccount(ctx) {
 				message: "Wallet Session sync is already committed; retry the exact method",
 				...bootstrap.committed
 			}, { status: 409 });
-			if (bootstrap.kind === "error") return json({
-				ok: false,
-				code: bootstrap.code,
-				message: bootstrap.message
-			}, { status: bootstrap.status });
+			if (bootstrap.kind === "error") return jsonFailure(bootstrap.status, bootstrap.code, bootstrap.message);
 			responseBody = bootstrap.body;
 		}
 		return json(responseBody, { status: syncAccountResponseStatus(result) });

package/dist/esm/router/transport/fetch/routes/syncAccountBootstrap.js

@@ -1,10 +1,10 @@
 import { mpcMaterialActivationRefsEqual, parseWebAuthnCredentialIdB64u, parseWebAuthnRpId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { parsePrincipalId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
-import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { isPlainObject } from "../../../../shared-ts/src/utils/validation.js";
+import { routerAbMpcMaterialActivationRefFromWire } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { parseRouterAbEcdsaCredentialFreeSessionActivationResponseV1, parseRouterAbEcdsaPostRegistrationSessionActivationPolicyV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { projectActiveWalletSession } from "../../../../authorization/domain.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { handleStrictEcdsaSessionActivation } from "./thresholdEcdsa.js";
 import { authorWalletUnlockEcdsaRequest } from "./sessions.js";
 import { DEFAULT_WALLET_SESSION_TTL_MS } from "../../../../shared-ts/src/threshold/sessionPolicy.js";

package/dist/esm/router/transport/fetch/routes/thresholdEcdsa.js

@@ -1,26 +1,27 @@
 import { parseEmailOtpChallengeId, parseOrgId, parseProviderSubject, parseWalletId } from "../../../../shared-ts/src/utils/domainIds.js";
 import { EVM_ECDSA_MPC_OPERATION_KINDS, buildEvmEcdsaMpcOperationRef, parseAuthFactorId, parseAuthorizationAuditEventId, parseAuthorizationEvidenceId, parseAuthorizationEvidenceSetId, parseAuthorizedOperationId, parseCapabilityId, parseCapabilityOperationId, parseEcdsaAuthorizationSessionId, parseWalletSessionMintId } from "../../../../shared-ts/src/authorization/capabilityKinds.js";
 import { base64UrlEncode } from "../../../../shared-ts/src/utils/base64.js";
-import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { alphabetizeStringify, sha256BytesUtf8 } from "../../../../shared-ts/src/utils/digests.js";
+import { parseDigestB64u } from "../../../../shared-ts/src/utils/canonicalPrimitives.js";
 import { buildCapabilityOperationEnvelope } from "../../../../shared-ts/src/authorization/operationFingerprint.js";
 import "../../../../shared-ts/src/utils/encoders.js";
-import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIntent.js";
 import { routerAbMpcMaterialActivationRefToWire, sameRouterAbMpcMaterialActivationRef } from "../../../../shared-ts/src/utils/routerAbNormalSigningIdentity.js";
 import { walletAuthAuthorityRef } from "../../../../shared-ts/src/utils/walletAuthAuthority.js";
 import { ROUTER_AB_ECDSA_DERIVATION_EXPORT_PATH, ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1, ROUTER_AB_ECDSA_DERIVATION_REFRESH_PATH, computeRouterAbEcdsaOperationStepUpChallengeB64u, parseRouterAbEcdsaDerivationActivationRefreshCommitRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1, parseRouterAbEcdsaDerivationExplicitExportRequestV1, parseRouterAbEcdsaOperationStepUpAuthorizationRequestV1, parseRouterAbEcdsaPostRegistrationSessionActivationRequestV1, parseRouterAbEcdsaPrepareSourceV1, sameRouterAbEcdsaDerivationNormalSigningScopeV1, sameRouterAbEcdsaDerivationPublicCapabilityV1 } from "../../../../shared-ts/src/utils/routerAbEcdsaDerivation.js";
 import { buildWalletSessionCapabilitySubjectsV1, projectActiveWalletSession } from "../../../../authorization/domain.js";
 import { buildVerifiedWalletOperationEmailOtpFactorResult, buildVerifiedWalletOperationPasskeyFactorResult } from "../../../../authorization/factorEvidence.js";
+import { walletIdFromString } from "../../../../shared-ts/src/utils/registrationIds.js";
 import { WALLET_SESSION_FAILURE_CODES } from "../../../../shared-ts/src/utils/walletSessionFailure.js";
 import { json, readJson } from "../../../framework/http.js";
 import { extractBearerCredential } from "../../../auth/routerApiKeyAuth.js";
 import { walletSessionFailure, walletSessionFailureStatus } from "../../../auth/walletSessionFailure.js";
 import { resolveWalletSessionOperationCredentialAdmission, validateEcdsaPreprocessingSession } from "../../../auth/commonRouterUtils.js";
-import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { hashEmailOtpOperationBinding } from "../../../domains/emailOtp/emailOtpSessionRouteHelpers.js";
+import { EMAIL_OTP_CHANNEL, WALLET_EMAIL_OTP_EXPORT_OPERATION, WALLET_EMAIL_OTP_TRANSACTION_SIGN_OPERATION } from "../../../../shared-ts/src/utils/emailOtpDomain.js";
 import { thresholdEcdsaStatusCode } from "../../../../threshold/statusCodes.js";
 import { parseEcdsaServerTiming } from "../../../../shared-ts/src/utils/ecdsaServerTiming.js";
-import { admitRouterAbEcdsaReusableWalletSessionOperation, authenticateRouterAbEcdsaOperationStepUp, authenticateRouterAbWalletOperationStepUpIdentity, authorizeRouterAbEcdsaDerivationNormalSigningRoute, buildRouterAbEcdsaOwnerOperationStepUpPreparation, claimRouterAbEcdsaOperationStepUp, completeRouterAbEcdsaOperation, decideRouterAbEcdsaOwnerOperationAuthorization, resolveFreshRouterAbEcdsaMaterialActivation, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayUnavailableResult } from "../../../domains/signingOperations/routerAbPrivateSigningWorker.js";
+import { authenticateRouterAbWalletOperationStepUpIdentity } from "../../../domains/signingOperations/routerAbOperationStepUp.js";
+import { admitRouterAbEcdsaReusableWalletSessionOperation, authenticateRouterAbEcdsaOperationStepUp, authorizeRouterAbEcdsaDerivationNormalSigningRoute, buildRouterAbEcdsaOwnerOperationStepUpPreparation, claimRouterAbEcdsaOperationStepUp, completeRouterAbEcdsaOperation, decideRouterAbEcdsaOwnerOperationAuthorization, resolveFreshRouterAbEcdsaMaterialActivation, routerAbEcdsaAtomicAuthorizationConfigured, routerAbEcdsaOperationInProgressResult, routerAbEcdsaOwnerOperationFailureResult, routerAbEcdsaReplayHttpResponse, routerAbEcdsaReplayUnavailableResult } from "../../../domains/signingOperations/routerAbEcdsaDerivationNormalSigningRoute.js";
 import { parseRouterAbEcdsaDerivationPoolFillInitRouteRequest, parseRouterAbEcdsaDerivationPoolFillStepRouteRequest } from "../../../domains/ecdsa/thresholdEcdsaRequestValidation.js";
 import { resolveWalletAuthMethodIdForAuthority } from "../../../../core/signingLanes/WalletExecutionLaneProjection.js";
 import { proxyNormalSigningRequestToMpcRouter, proxyOwnerLaneAdmittedNormalSigningRequest } from "./normalSigningRouterProxy.js";
@@ -41,6 +42,39 @@ function requireAuthorizationValue(result) {
 	if (!result.ok) throw new Error(result.error.message);
 	return result.value;
 }
+/**
+* The Router binding for a verified step-up: the wallet it signs for and the
+* Console project environment of the store that claimed the operation, so
+* the SigningWorker reaches the wallet's own storage.
+*/
+async function ecdsaOperationStepUpBinding(ctx, session, operation) {
+	const scope = session.runtimePolicyScope;
+	const pinned = await readPinnedEcdsaStepUpWalletScope(ctx, session, operation);
+	return {
+		kind: "operation_step_up",
+		authorizationSessionId: session.sessionId,
+		orgId: scope.orgId,
+		projectId: scope.projectId,
+		environment: scope.envId,
+		projectEnvironmentId: pinned.projectEnvironmentId,
+		subjectId: session.principalId,
+		accountId: session.walletId
+	};
+}
+async function readPinnedEcdsaStepUpWalletScope(ctx, session, operation) {
+	const walletId = parseWalletId(session.walletId);
+	if (!walletId.ok) throw new Error("ECDSA step-up wallet identity is invalid");
+	const pinned = await ctx.service.authorizedOperations.readPinnedOwnerWalletScope({
+		operation,
+		walletId: walletId.value
+	});
+	const scope = session.runtimePolicyScope;
+	if (pinned.orgId !== scope.orgId || pinned.projectId !== scope.projectId) throw new Error("Step-up wallet scope differs from the Wallet Session scope");
+	return {
+		...pinned,
+		walletId: session.walletId
+	};
+}
 function buildRouterAbEcdsaAuthorizedOperationWire(input) {
 	const operation = input.operation;
 	const operationRef = operation.operation.operation;
@@ -84,6 +118,7 @@ function buildRouterAbEcdsaAuthorizedOperationWire(input) {
 					org_id: input.binding.orgId,
 					project_id: input.binding.projectId,
 					environment: input.binding.environment,
+					project_environment_id: input.binding.projectEnvironmentId,
 					signing_worker_id: input.binding.signingWorkerId,
 					expires_at_ms: input.binding.expiresAtMs
 				},
@@ -101,7 +136,9 @@ function buildRouterAbEcdsaAuthorizedOperationWire(input) {
 					org_id: input.binding.orgId,
 					project_id: input.binding.projectId,
 					environment: input.binding.environment,
-					subject_id: input.binding.subjectId
+					project_environment_id: input.binding.projectEnvironmentId,
+					subject_id: input.binding.subjectId,
+					account_id: input.binding.accountId
 				},
 				authorized_operation: {
 					kind: "verified_step_up_authorized_operation_v1",
@@ -147,16 +184,16 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 	if (input.phase === "finalize" && rawSource !== void 0) return json({
 		ok: false,
 		code: "invalid_body",
-		message: "Finalize cannot carry a presign batch"
+		message: "Finalize cannot carry a presign source"
 	}, { status: 400 });
-	let source = { kind: "available_pool" };
 	if (input.phase === "prepare") try {
-		source = parseRouterAbEcdsaPrepareSourceV1(rawSource, parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(signingBody));
+		parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(signingBody);
+		parseRouterAbEcdsaPrepareSourceV1(rawSource);
 	} catch {
 		return json({
 			ok: false,
 			code: "invalid_body",
-			message: "Invalid signing prepare request or final batch"
+			message: "Invalid signing prepare request or source"
 		}, { status: 400 });
 	}
 	input = {
@@ -196,28 +233,16 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 		authorizedOperation = decision.operation;
 		authorizedOperationWire = buildRouterAbEcdsaAuthorizedOperationWire({
 			operation: authorizedOperation,
-			binding: {
-				kind: "operation_step_up",
-				authorizationSessionId: authorization.session.sessionId,
-				orgId: authorization.session.runtimePolicyScope.orgId,
-				projectId: authorization.session.runtimePolicyScope.projectId,
-				environment: authorization.session.runtimePolicyScope.envId,
-				subjectId: authorization.session.principalId
-			}
+			binding: await ecdsaOperationStepUpBinding(input.ctx, authorization.session, authorizedOperation)
 		});
 	} else {
+		const request = input.phase === "prepare" ? parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(input.body) : parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input.body);
 		const operation = await admitRouterAbEcdsaReusableWalletSessionOperation({
-			request: input.phase === "prepare" ? parseRouterAbEcdsaDerivationEvmDigestSigningRequestV1(input.body) : parseRouterAbEcdsaDerivationEvmDigestSigningFinalizeRequestV1(input.body),
-			materialActivation: authorization.admission.materialActivation,
-			binding: authorization.kind === "wallet_session_operation_credential_v1" ? {
-				kind: "wallet_session_operation_credential_v1",
-				context: authorization.validated.admission.context
-			} : {
-				kind: "wallet_session_operation_credential_exhausted_candidate_v1",
-				candidate: authorization.candidate
-			},
-			authorizedOperations: input.ctx.service.authorizedOperations,
-			resolveEcdsaMaterialActivation: input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation.bind(input.ctx.service.walletRegistration)
+			phase: input.phase,
+			request,
+			material: authorization.activeMaterial,
+			binding: authorization,
+			authorizedOperations: input.ctx.service.authorizedOperations
 		});
 		if (!operation.ok) {
 			const failureBody = operation.error.body;
@@ -243,11 +268,6 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 			return json(failure.body, { status: failure.status });
 		}
 		if (operation.admission.kind === "replayed") return routerAbEcdsaReplayResponse(operation.admission.operation);
-		if (operation.admission.kind === "claimed" && input.phase === "finalize") return json({
-			ok: false,
-			code: "authorized_operation_missing",
-			message: "ECDSA finalize requires a claimed prepare operation"
-		}, { status: 409 });
 		const ownerDecision = decideRouterAbEcdsaOwnerOperationAuthorization({ operation: operation.admission.operation });
 		switch (ownerDecision.kind) {
 			case "authorized": break;
@@ -276,6 +296,8 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 		authorizedOperation = operation.admission.operation;
 		const session = authorization.kind === "wallet_session_operation_credential_v1" ? authorization.validated.admission.context.authorization.session : authorization.candidate.status.session;
 		const runtimePolicyScope = authorization.activeMaterial.runtimePolicyScope;
+		const pinnedOwnerScope = operation.admission.ownerScope;
+		if (pinnedOwnerScope.orgId !== runtimePolicyScope.orgId || pinnedOwnerScope.projectId !== runtimePolicyScope.projectId) throw new Error("Pinned ECDSA owner Wallet Session scope differs from active material");
 		authorizedOperationWire = buildRouterAbEcdsaAuthorizedOperationWire({
 			operation: authorizedOperation,
 			binding: {
@@ -289,6 +311,7 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 				orgId: runtimePolicyScope.orgId,
 				projectId: runtimePolicyScope.projectId,
 				environment: runtimePolicyScope.envId,
+				projectEnvironmentId: pinnedOwnerScope.projectEnvironmentId,
 				signingWorkerId: authorization.activeMaterial.materialActivation.signing_worker,
 				expiresAtMs: session.expiresAtMs
 			}
@@ -308,8 +331,7 @@ async function executeRouterAbEcdsaDerivationNormalSigningRoute(input, timing) {
 	};
 	const admittedBody = {
 		...input.body,
-		authorized_operation: authorizedOperationWire,
-		...source.kind === "final_presign_batch" ? { presign_source: source } : {}
+		authorized_operation: authorizedOperationWire
 	};
 	const proxyStartedAt = performance.now();
 	const upstream = authorization.kind === "wallet_session_operation_credential_v1" || authorization.kind === "wallet_session_operation_credential_exhausted_candidate_v1" ? await proxyNormalSigningRequestToMpcRouter({
@@ -470,6 +492,7 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 		message: v2Resolution.message
 	}, { status: 403 });
 	const activeMaterial = v2Resolution.kind === "admitted" ? v2Resolution.activeMaterial : await input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+		source: { kind: "database" },
 		walletId: operation.wallet_id,
 		materialActivation: operation.material_activation
 	});
@@ -788,7 +811,6 @@ async function issueEcdsaOperationStepUpAuthorization(input) {
 async function handleEcdsaPoolFillRoute(input) {
 	const startedAt = performance.now();
 	const timing = {
-		queue: null,
 		authenticate: null,
 		material: null,
 		admit: null,
@@ -823,31 +845,24 @@ async function executeEcdsaPoolFillRoute(input, timing, workerTimings) {
 	const parsed = input.phase === "init" ? parseRouterAbEcdsaDerivationPoolFillInitRouteRequest(input.body) : parseRouterAbEcdsaDerivationPoolFillStepRouteRequest(input.body);
 	if (!parsed.ok) return json(parsed.body, { status: thresholdEcdsaStatusCode(parsed.body) });
 	const request = parsed.request;
-	const queuedAt = performance.now();
-	const gateTicket = await presignPriorityGate.acquire(resolvePresignTrafficClass(request.requestTag));
-	timing.queue = performance.now() - queuedAt;
-	try {
-		const authorized = await authorizeEcdsaPoolFill({
-			ctx: input.ctx,
-			request,
-			timing
-		});
-		if (!authorized.ok) return json(authorized.error.body, { status: authorized.error.status });
-		const proxyStartedAt = performance.now();
-		const result = "poolFill" in request ? await runtime.initializePoolFill({
-			binding: authorized.binding,
-			request: ecdsaPoolFillInitRuntimeRequest(request),
-			onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
-		}) : await runtime.advancePoolFill({
-			binding: authorized.binding,
-			request: ecdsaPoolFillStepRuntimeRequest(request),
-			onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
-		});
-		timing.proxy = performance.now() - proxyStartedAt;
-		return json(result, { status: thresholdEcdsaStatusCode(result) });
-	} finally {
-		gateTicket.release();
-	}
+	const authorized = await authorizeEcdsaPoolFill({
+		ctx: input.ctx,
+		request,
+		timing
+	});
+	if (!authorized.ok) return json(authorized.error.body, { status: authorized.error.status });
+	const proxyStartedAt = performance.now();
+	const result = "poolFill" in request ? await runtime.initializePoolFill({
+		binding: authorized.binding,
+		request: ecdsaPoolFillInitRuntimeRequest(request),
+		onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
+	}) : await runtime.advancePoolFill({
+		binding: authorized.binding,
+		request: ecdsaPoolFillStepRuntimeRequest(request),
+		onServerTiming: collectEcdsaPresignWorkerTiming.bind(void 0, workerTimings)
+	});
+	timing.proxy = performance.now() - proxyStartedAt;
+	return json(result, { status: thresholdEcdsaStatusCode(result) });
 }
 function poolFillMaterialActivation(request) {
 	return "poolFill" in request ? request.poolFill.scope.material_activation : null;
@@ -898,7 +913,7 @@ async function authorizeEcdsaPoolFillOperationStepUp(input) {
 		}
 	};
 	const admissionStartedAt = performance.now();
-	const claimFailure = await claimRouterAbEcdsaOperationStepUp({
+	const claim = await claimRouterAbEcdsaOperationStepUp({
 		operationKind: "evm.sign_transaction",
 		operation: input.operation,
 		materialActivation: freshMaterial.materialActivation,
@@ -906,10 +921,22 @@ async function authorizeEcdsaPoolFillOperationStepUp(input) {
 		authenticated
 	});
 	input.timing.admit = performance.now() - admissionStartedAt;
-	if (claimFailure && "status" in claimFailure) return {
+	if (claim && "status" in claim) return {
 		ok: false,
-		error: claimFailure
+		error: claim
+	};
+	if (!claim) return {
+		ok: false,
+		error: {
+			status: 409,
+			body: {
+				ok: false,
+				code: "authorized_operation_missing",
+				message: "ECDSA pool-fill step-up operation is unavailable"
+			}
+		}
 	};
+	const ownerWalletScope = await readPinnedEcdsaStepUpWalletScope(input.ctx, authenticated.session, claim.operation);
 	const walletId = parseWalletId(input.operation.wallet_id);
 	if (!walletId.ok) return {
 		ok: false,
@@ -935,6 +962,7 @@ async function authorizeEcdsaPoolFillOperationStepUp(input) {
 				kind: "operation_step_up",
 				materialExpiresAtMs: input.operation.expires_at_ms
 			},
+			ownerWalletScope,
 			routerAbEcdsaDerivationNormalSigning: {
 				kind: ROUTER_AB_ECDSA_DERIVATION_NORMAL_SIGNING_STATE_KIND_V1,
 				scope: input.operation.normal_signing_scope
@@ -973,6 +1001,7 @@ async function authorizeEcdsaPoolFill(input) {
 			const admitted = validated;
 			const materialStartedAt = performance.now();
 			const activeMaterial = await input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+				source: { kind: "database" },
 				walletId: String(session.walletId),
 				materialActivation: routerAbMpcMaterialActivationRefToWire(admitted.materialActivation)
 			});
@@ -1012,6 +1041,7 @@ async function authorizeEcdsaPoolFill(input) {
 					participantIds: activeMaterial.participantIds,
 					thresholdExpiresAtMs: session.expiresAtMs,
 					authorization: { kind: "wallet_session" },
+					ownerWalletScope: validated.ownerWalletScope,
 					routerAbEcdsaDerivationNormalSigning: normalSigning
 				}
 			};
@@ -1060,43 +1090,6 @@ function ecdsaPoolFillStepRuntimeRequest(request) {
 		...request.requestTag === void 0 ? {} : { requestTag: request.requestTag }
 	};
 }
-function resolvePresignPriorityTurn(resolve) {
-	setTimeout(resolve, 5);
-}
-function waitForPresignPriorityTurn() {
-	return new Promise(resolvePresignPriorityTurn);
-}
-var PresignPriorityGate = class {
-	constructor() {
-		this.foregroundInFlight = 0;
-		this.backgroundInFlight = 0;
-	}
-	async acquire(trafficClass) {
-		if (trafficClass === "foreground") {
-			this.foregroundInFlight += 1;
-			return this.createTicket("foreground");
-		}
-		while (!this.canRunBackgroundNow()) await waitForPresignPriorityTurn();
-		this.backgroundInFlight += 1;
-		return this.createTicket("background");
-	}
-	createTicket(trafficClass) {
-		let released = false;
-		return { release: () => {
-			if (released) return;
-			released = true;
-			if (trafficClass === "foreground") this.foregroundInFlight = Math.max(0, this.foregroundInFlight - 1);
-			else this.backgroundInFlight = Math.max(0, this.backgroundInFlight - 1);
-		} };
-	}
-	canRunBackgroundNow() {
-		return this.foregroundInFlight === 0 && this.backgroundInFlight === 0;
-	}
-};
-function resolvePresignTrafficClass(requestTag) {
-	return requestTag === "background_presign_pool_refill" ? "background" : "foreground";
-}
-const presignPriorityGate = new PresignPriorityGate();
 function strictEcdsaAuthorizationFailureStatus(failure) {
 	switch (failure.code) {
 		case "unauthorized": return 401;
@@ -1479,6 +1472,7 @@ async function authorizeStrictEcdsaExport(input) {
 			scope: operation.normal_signing_scope
 		})) return strictEcdsaExportFailure(403, "scope_mismatch", "ECDSA export operation scope does not match the request");
 		const activeMaterial = await input.ctx.service.walletRegistration.resolveEcdsaMaterialActivation({
+			source: { kind: "database" },
 			walletId: operation.wallet_id,
 			materialActivation: input.request.material_activation
 		});
@@ -1782,6 +1776,6 @@ async function handleThresholdEcdsa(ctx) {
 	return null;
 }
 //#endregion
-export { authorizeEcdsaPoolFill, authorizeStrictEcdsaSessionActivationFromOperationCredential, decideRouterAbEcdsaOperationStepUpExecution, finishRouterAbEcdsaSigningResponse, handleStrictEcdsaSessionActivation, handleThresholdEcdsa, resolveV2EcdsaCustodySigner };
+export { authorizeEcdsaPoolFill, finishRouterAbEcdsaSigningResponse, handleStrictEcdsaSessionActivation, handleThresholdEcdsa };
 
 //# sourceMappingURL=thresholdEcdsa.js.map